Release packaging: the MSI's licence files get a component GUID, the mounted dmg is verified without --strict, shellcheck follows env.sh

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/.shellcheckrc

@@ -0,0 +1,3 @@
+# shellcheck config for the packaging scripts (CI: .github/workflows/packaging-lint.yml).
+source-path=SCRIPTDIR
+external-sources=true